- cypherpunks-legacy - lists.cpunks.org

Re: German Wiretappers Bill Victims
by Steve Schear 06 Nov '02

06 Nov '02

At 08:09 AM 11/6/2002 +0100, Eugen Leitl wrote: >On Tue, 5 Nov 2002, Bill Stewart wrote: > > > http://www.theregister.co.uk/content/5/27917.html > > > > German secret service taps phones, bills buggees I wonder if its possible if this billing incident wasn't a mistake, but an activist "pulling down the pants" of their security services. steve

1 0

Did you *really* zeroize that key?
by Trei, Peter 06 Nov '02

06 Nov '02

>From RISKS: http://catless.ncl.ac.uk/Risks/22.35.html#subj6 Those of us who write code need to be reminded of this now and then. Peter Trei --------------- Software leaves encryption keys, passwords lying around in memory Monty Solomon <monty(a)roscom.com> Wed, 30 Oct 2002 22:31:46 -0500 http://online.securityfocus.com/archive/82/297827 Date: Thu, 31 Oct 2002 05:11:31 +1300 (NZDT) From: pgut001(a)cs.auckland.ac.nz (Peter Gutmann) Subject: Software leaves encryption keys, passwords lying around in memory The following problem was first pointed out (in private mail) by Michael Howard from Microsoft. His writeup is now available at http://msdn.microsoft.com/library/en-us/dncode/html/secure10102002.asp. From a representative check of a few widely-used open source crypto programs, this affects quite a bit of software. The problem he points out is that clearing sensitive information such as encryption keys from memory may not work as expected because an optimising compiler removes the memset() if it decides it's redundant. Consider for example the following: int encrypt( const void *key ) { puts( key ); /* Normally we'd encrypt here */ } void main( void ) /* Because we can */ { char key[ 16 ]; strcpy( key, "secretkey" ); encrypt( key ); memset( key, 0, 16 ); } When compiled with any level of optimisation using gcc, the key clearing call goes away because of dead code elimination (see the MSDN article for more details on this, which uses VC++ to get the same effect). While you can kludge enough stuff around a custom memory-clear call to fool the optimiser (hacks with 'volatile', touching the memory after it's cleared and hoping the optimiser is fooled, etc etc) there's no guarantee that it'll work for anything but the compiler(s) you happen to test it with - any future enhancement to the optimiser may turn it back into a nop. What it really needs is the addition of a #pragma dont_remove_this_code_you_bastard in the compiler. Until then, a lot of security code will be affected by this problem. [In RISKS, I tend never to alter British spellings. However, in American English, an "optimiser" must be the ultimate miser.]

1 0

Respond for Your FREE Euro!
by oil9783hj2157h37＠cs.com 06 Nov '02

06 Nov '02

1 0

cypherpunks, Try Gen*ric Blue Pill for only $5.00 per 100MG dose
by Howell Corritore 06 Nov '02

06 Nov '02

1 0

US Airways' Domestic E-Savers
by ESavers＠usairways.com 06 Nov '02

06 Nov '02

Dear E-Savers Subscriber, US Airways is pleased to present this weekend's Domestic E-Savers offers: ************************************************************ 1. This Weekend's Domestic E-Savers 2. Earn Up To 7,000 Bonus Miles 3. Last-Minute Hotel Deals 4. Dividend Miles Offers 5. E-Savers Fare Requirements 6. Subscription Information ************************************************************ 1. THIS WEEKEND'S DOMESTIC E-SAVERS ************************************************************ We will not be offering Domestic E-Savers for travel during the weekends of Nov. 30, Dec. 28 and Jan. 4 due to the upcoming holiday season. But you can still take advantage of other great travel deals at http://www.usairways.com/promotions Here are this week's E-Savers for travel departing Saturday, November 9 and returning Sunday, November 10; Monday, November 11; or Tuesday, November 12. For travel this weekend, make your reservations online at http://www.usairways.com/promotions/esavers/offers_nov9.htm These special fares can also be purchased by calling 1-888-359-3728. Tickets must be purchased at the time of reservation. ROUNDTRIP FROM: TO: FARE: ------------------------------------------------------------- Atlanta, GA San Francisco, CA $198 (C) Baltimore, MD Los Angeles, CA $228 (C) Birmingham, AL Charlotte, NC $138 Boston, MA Buffalo, NY $128 (#4) Boston, MA Cincinnati, OH $128 (*)(C) Boston, MA Richmond, VA $128 (*)(#4) Buffalo, NY Los Angeles, CA $218 (C) Buffalo, NY Philadelphia, PA $128 Charleston, SC Boston, MA $148 (C) Charlotte, NC Baltimore, MD $148 Charlotte, NC Chattanooga, TN $128 (#6) Charlotte, NC Chicago O'Hare, IL $158 (*) Charlotte, NC Cincinnati, OH $138 (*)(#8) Charlotte, NC Manchester, NH $138 Charlotte, NC Newark, NJ $168 Charlotte, NC San Francisco, CA $238 Chicago O'Hare, IL Charlotte, NC $158 (*) Chicago O'Hare, IL Pittsburgh, PA $138 (*) Cincinnati, OH Boston, MA $128 (*)(C) Cincinnati, OH Charlotte, NC $138 (*)(#8) Columbus, OH Philadelphia, PA $138 (*) Dallas/Ft. Worth, TX Baltimore, MD $168 (C) Denver, CO Philadelphia, PA $198 Greensboro, NC Hartford, CT $148 (C) Greenville/Spart., SC Hartford, CT $148 (C) Harrisburg, PA New York LaGuardia, NY $108 (#1) Houston, TX Philadelphia, PA $168 Indianapolis, IN Pittsburgh, PA $118 Jacksonville, FL Philadelphia, PA $148 Knoxville, TN Washington National, DC $128 (#7) Los Angeles, CA New York LaGuardia, NY $228 (C) Manchester, NH Philadelphia, PA $138 Miami, FL Pittsburgh, PA $158 Milwaukee, WI Rochester, NY $138 (C) Minneapolis/St. Paul, MN Boston, MA $178 (C) Nashville, TN Pittsburgh, PA $128 New York LaGuardia, NY Cincinnati, OH $118 (C) New York LaGuardia, NY Richmond, VA $108 (#2) New York LaGuardia, NY Washington Dulles, DC $128 (#3) Norfolk, VA Atlanta, GA $118 (C) Philadelphia, PA Boston, MA $118 Philadelphia, PA Chicago O'Hare, IL $148 Philadelphia, PA Columbia, SC $138 (#5) Philadelphia, PA Columbus, OH $138 (*) Philadelphia, PA Los Angeles, CA $228 Philadelphia, PA Raleigh/Durham, NC $138 Pittsburgh, PA Chicago O'Hare, IL $138 (*) Pittsburgh, PA Dayton, OH $118 (#7) Pittsburgh, PA Greensboro, NC $138 Pittsburgh, PA Hartford, CT $128 Pittsburgh, PA Los Angeles, CA $228 Pittsburgh, PA New York LaGuardia, NY $148 Portland, ME Philadelphia, PA $128 Providence, RI Cincinnati, OH $138 (C) Raleigh/Durham, NC New York LaGuardia, NY $148 (#4) Richmond, VA Boston, MA $128 (*)(#4) Rochester, NY Pittsburgh, PA $118 San Francisco, CA New York LaGuardia, NY $228 (C) Washington National, DC Boston, MA $148 Washington National, DC Raleigh/Durham, NC $128 (#8) Washington National, DC Rochester, NY $138 (#1) West Palm Beach, FL Charlotte, NC $148 Roundtrip purchase required. (*) Indicates available for travel originating in either city (C) Indicates travel requires a connecting flight (#) Indicates travel is wholly on US Airways Express, served by the following carriers: 1. Allegheny 2. Allegheny/Chautauqua 3. Allegheny/Colgan 4. Chautauqua 5. Chautauqua/Mesa/PSA 6. Mesa/Piedmont 7. Mesa/PSA 8. Piedmont/PSA Fares shown are based on roundtrip Coach travel on US Airways/US Airways Express, during the period specified above. Depending upon your travel needs, alternative routings may be available at the same fares, with part of the service on regional aircraft operated by US Airways Express carriers Allegheny, Air Midwest, CCAIR, Chautauqua, Colgan, Mesa, Piedmont, PSA, Shuttle America or Trans States. ************************************************************ 2. EARN UP TO 7,000 BONUS MILES ************************************************************ Apply for the Dividend Miles Visa Platinum Credit Card from Bank of America and start earning free travel on US Airways and our airline partners. Receive up to 7,000 bonus miles after making your first purchase. And then each time you make a purchase, you will earn one mile for every dollar spent and two miles for every dollar spent on purchases made directly from US Airways*. For details or to apply, call 1-800-335-4340 or visit http://www.bankofamerica.com/adtrack/index.cgi?adlink=00030200514952973951 *Dividend Miles Visa Platinum Credit Card Terms & Conditions Earn one mile for every dollar spent, less any purchase credits other than payments ("Net Purchases"). Double miles apply to the purchase of all US Airways goods and services purchased directly from US Airways. Double miles do not apply to the purchase of US Airways Vacations. Mileage accumulation may be subject to certain limitations, restrictions and exclusions. Other terms and conditions may apply. ************************************************************ 3. LAST-MINUTE HOTEL DEALS ************************************************************ US Airways has teamed up with hoteldiscounts.com to offer E-Savers subscribers great discounts at hotels in this weekend's E-Savers destinations. Simply visit http://www.hoteldiscounts.com/usairways/index.html and click on the E-Savers destination you're planning to visit. hoteldiscounts.com will list a variety of hotels offering a wide range of rates for you to choose from. Book your room online or call hoteldiscounts.com directly at 1-800-645-6144. Here's a sample of this week's special rates from hoteldiscounts.com: Baltimore from $75.95 Charlotte from $49.95 Hartford from $65.95 Newark from $69.95 San Francisco from $49.95 ************************************************************ 4. DIVIDEND MILES OFFERS ************************************************************ Did you know you could earn thousands of Dividend Miles when you buy, sell, and/or finance your home or obtain an auto loan through LendingTree? It's one of the most generous mileage offers around. Visit http://www.lendingtree.com/usairways/default.asp?source=esavers for complete details. Already a Dividend Miles member? You can earn triple miles on every US Airways Shuttle flight you fly through December 31, 2002. Plus, your bonus miles will count towards earning Preferred status. Register before you take your next US Airways Shuttle flight at http://www.usairways.com/dividendmiles/5236.htm Reminder: Make sure your Dividend Miles account number is in your E-Savers reservation, so you can earn miles for worldwide award travel on US Airways and our partners. To enroll in Dividend Miles, go to http://www.usairways.com/ To earn even more miles, book E-Savers using your US Airways Dividend Miles Visa card. To apply for the Dividend Miles Visa card issued by Bank of America, please visit us at http://www.usairways.com/dmcreditcards Please note: Mileage bonus for booking online does not apply to E-Savers. ************************************************************ 5. E-SAVERS FARE REQUIREMENTS ************************************************************ - Restrictions: Seats are limited and are not available on all flights/days. Fares cannot be combined with other fares, discounts, promotions or coupons. Travel must begin and end in the same city. One-way travel, stopovers, waitlisting and standbys are not permitted. Tickets must be purchased at the time of reservation. Fares will not be honored retroactively or in conjunction with the exchange of any partially used ticket. - Travel: Depart Saturday, 11/9/02, and return Sunday, Monday or Tuesday, 11/10-11/12/02. - Taxes/Fees: Fares do not include a $3 federal excise tax which will be imposed on each flight segment of your itinerary. A flight segment is defined as a takeoff and a landing. Fares for Canada do not include total government-imposed taxes and fees of up to $65. Depending on the itinerary, passenger facility charges of up to $18 and the September 11th Security Fee of up to $10 may apply in addition to the fare. - Changes: Tickets become non-refundable 24 hours after making initial reservation, and may be changed prior to the departure of each flight segment for a minimum $100 fee. If changes are not made prior to the departure date/time of each flight, the entire remaining ticket will have no further value. - Miscellaneous: Lower fares may be available in these markets. Other conditions apply. ************************************************************ 6. SUBSCRIPTION INFORMATION ************************************************************ This is a post-only mailing sent to CYPHERPUNKS(a)ALGEBRA.COM. If you would like to change your e-mail address, you will need to unsubscribe and resubscribe at the E-Savers Enrollment page: http://www.usairways.com/promotions/esavers/enroll/index.htm To unsubscribe from this list, please click here: http://www.usairways.com/cgi-bin/delete.cgi?email=CYPHERPUNKS@ALGEBRA.COM To change your departure city preferences, please visit: http://www.usairways.com/promotions/esavers/enroll/index.htm Please do not respond to this message. Copyright US Airways 1996-2002. All rights reserved.

1 0

Re: "patent free(?) anonymous credential system pre-print" - a simple attack and other problems
by Jason Holt 06 Nov '02

06 Nov '02

(Re: my paper at http://eprint.iacr.org/2002/151/ ) Stefan Brands wrote: > - The system is subject to a simple attack. The problem lies with the > multiplication of the hashes. Let's take the Chaum blinding as an [...] (For our readers at home, that was the vulnerability I mentioned in my response to Adam). [...] > - My work certainly does provide for "revocable anonymity" and "pooling" > prevention. For pooling protection, see paragraph 2 on page 193, > section 5.11 page 210 paragraph 2, and section 5.5.2 on page 211. For [...] When I speak of pooling credentials, I'm talking about Alice presenting her student ID along with the senior-citizen ID Bob loaned her (or for which Bob is answering clandestine-ly), as if they both belonged to her, in order to get both discounts on her movie tickets. In my system, you get your credentials issued in a set associated with a single identity, and it's hard for Alice to get Bob's credentials included in one of her own sets. It works even if the CAs don't trust each other. Page 211 of your book talks about discouraging lending, which doesn't help in the case when Bob answers in Alice's behalf when she shows his credentials. In any case, section 5.5.2 only adds liability to pooling - it doesn't prevent it mathematically. (As to lending in general, I think you're right that discouragement may be the best we can do). Page 193 and 210 do talk about having an identifying value encoded in the credentials which the holder can prove is or isn't the same as in other credentials. However, the discussion on page 193 is with respect to building digital pseudonyms, and the discussion on page 210 seems to be about showing that values are *not* the same, following a scenario in which a pseudonym holder has been identified as a misbehaver. I can think of ways in which this feature might be leveraged to create otherwise-unlinkable sets of credentials from different (distrusting) CAs, but it's never addressed directly that I can see, and would need some specifics filled in. Nonetheless, I'll point out in my paper that it's a possibility in your system. > - The proposed hashing technique for selective disclosure was introduced > by myself in 1999. Quoting from page 27 of my MIT Press book titled [...] Pages 27 and 184 of your book are now both referenced in my section on selective disclosure. > - More seriously, the simple hash technique has numerous drawbacks, as I > explain on page page 27 of my MIT Press book, in the very same > paragraph: "Although certificate holders now have some control over > which attributes they reveal to verifiers, they are forced to leave > behind digital signatures. ... [...] What do you mean by "forced to leave behind digital signatures"? > ... Worse, nothing prevents the CA and others from tracing and linking all > the communications and transactions of each certificate holder." ... [...] This is of course overcome in my system with blinding and cut-and-choose. > [ > Snipped discussion of features which Brands' system has and my system > doesn't: boolean formulae, lending prevention, limited show, > wallet-with-observer, discarding protection, anonymous recertification / > updating, multi-application certificates, etc. > ] From my response to Adam Back: I'm glad that was clear in my text. This isn't a do-everything system like Brands' - rather, it has 2 aims. 1: show how to do simple selective disclosure in a Chaum/Fiat/Naor-like system using X.509v3 credentials as a base, and 2: show how to link credentials from multiple issuers to the same identity without compromising anonymity. And actually, I forgot to mention the original goal of my paper, which was to create a system not encumbered by your patents or Chaum's. I'll expand my related work section to point out that your system and others have lots of features which my system doesn't attempt to provide. My apologies if my terse treatment mischaracterized your work. -J

1 0

中国教育网：吉林特产高等专科学校2003年招生
by owner-cypherpunks＠minder.net 06 Nov '02

06 Nov '02

1 0

Special situation commodity moves
by Capitol Commodity Services, Inc. 05 Nov '02

05 Nov '02

Right now there are changes taking place that have captured our attention. We have analyzed certain markets and we believe they could present substantial trading opportunities. There is a substantial risk of loss in futures trading. We have even gone so far as to become registered as Commodity Trading Advisors (CTA) for the first time in our 20-year history. Our low-commission, low-minimum Managed Account Program has been launched and our customers are quite profitable. A copy of our registered CTA disclosure document is available upon request. http://www.ccstrade.com/forms/capitol_ddoc.doc Reply to this email or call me at (317) 848-8050 or (800) 876-8050 to discuss these trading opportunities. Lannie Cohen, President Capitol Commodity Services, Inc. Serving Futures Traders Since 1983 There is a substantial risk of loss in futures trading. Past results are not necessarily indicative of future results.

1 0

Re: patent free(?) anonymous credential system pre-print
by Nomen Nescio 05 Nov '02

05 Nov '02

Stefan Brands writes regarding http://eprint.iacr.org/2002/151/: > The paper shows some promise but, apart from being insecure, has other > drawbacks that should be addressed: > > ... My work... introduced by myself... my MIT press book... > > In addition to various other drawbacks pointed out by of Dr. Adam Back > (see www.mail-archive.com/cypherpunks-moderated@minder.net/msg02752.html) > the proposal does not offer a wallet-with-observer mode, discarding > protection, anonymous recertification / updating, multi-application > certificates, etcetera. And balanced against all these numerous shortcomings, there is one inescapable, overwhelming fact: THE AUTHORS ARE MAKING THE FRUITS OF THEIR LABOR AVAILABLE FREELY FOR THE WORLD TO USE. With all of your patents, and your writings, and your self-promotion, how many people are using your certificates in the real world? Think how much you could have accomplished, how much of a difference you could have made, if you had been willing to sacrifice the hope of great riches. Instead you have followed in the footsteps of your mentor Chaum, and both of you have withheld your talent from the world. What is it about cash and credential systems that everyone who works in the area thinks they should patent their results? All you have accomplished is to make sure that no implementations exist! What good are your great ideas if no one can use them? Look at Chaum! Is that where you want to be in 20 years? Bitter and barren? Cut off from the cryptographic community? Reduced to publishing via the government patent office? That's no life for a great mind. Creativity demands interaction with an active and vital intellectual community. You have to give in order to take. Building walls around your intellectual property shuts others out even as you shut yourself in. If you really want to accomplish something meaningful, rather than continuing to hype and shill for a system which no one can use without entering into delicate financial negotiations, why not make it available on some basis for people to experiment with? Maybe a non-commercial, open-source GPL implementation could be a starting point. There is considerable interest in reputation systems among the P2P community and credentials could be a part of that. You can still protect your commercial interests while letting people get familiar with the technology by making a non-commercial library available. That's just one possibility. The point is, your ideas are going nowhere using your present strategy. Either this technology won't be used at all, or inferior but unrestricted implementations will be explored, as in the recent work. If you want things to happen differently, you must change your strategy.

1 0

世界旅游网欢迎您!
by hk 05 Nov '02

05 Nov '02

1 0